Part 6, WordPress Automatic Updates – Shield WordPress Security Plugin

• Part 1: Why we built the Shield
• Part 2: WordPress Super Admin Protection
• Part 3: WordPress Firewall Feature
• Part 4: WordPress Login and Brute Force Hacking Protection
• Part 5: WordPress Comment SPAM Killer
• Part 6: WordPress Automatic Updates Management

The WordPress automatic updates system has shipped with WordPress since version 3.7.

The Shield plugin helps administrators manage automatic updates to better suit their particular needs.

This automatic updates feature was added after the core WordPress development team opted to not offer a UI (user interface) against this feature.

In this article I’ll outline a what the WordPress automatic updates system is, how it works, and how exactly the Shield plugin assists administrators.

What is the WordPress Automatic Updates System?

When the Automatic Updates system was released, we wrote about it in detail here to help us all understand it a bit better. I suggest taking a read of that and then jumping back here.

In summary, automatic updates is a good thing. It ensures that WordPress minor releases, that typically apply security patches, are applied promptly to as many WordPress sites as possible.

There are many who disagree that automatic updates is a good thing, but for minor releases at least, we can see no harm in it.

How does the WordPress Automatic Updates System actually work?

There are 2 stages to the WordPress automatic updates system, and this causes a lot of confusion. It’s sometimes appears that their site isn’t automatically updating…

1. WordPress detects the availability of an update
2. WordPress runs the process to automatically apply detected updates

Both of these stages rely on the WordPress cron, and the WordPress cron relies on people visiting the site.  If no-one visits the site, the WordPress cron never runs.

So first of all, given the schedule that WordPress has created, it will query the availability of updates for the site.  This runs twice daily.

Then, on a separate schedule, it’ll apply any detected updates. This also runs twice daily.

Basically on the outside, it could take up to 24 hours before an update is detected and applied to a site by the automatic updates system (and that’s assuming you have visitors to the site to kick off the crons promptly).

How does Shield assist with WordPress Automatic Updates?

WordPress doesn’t automatically update everything, it only updates WordPress Core minor releases.

WordPress core developers have offered a detailed guide on how to configure the updates system if you want it to update other elements of a site, such as:

• WordPress major releases
• WordPress Plugins
• WordPress Themes

You can also completely disable the automatic updates system if you want complete control over when it’ll run.

The Shield plugin let’s you turn on or off all automatic updates for all elements included in the WordPress background updates system.

Reviewing Shield’s Automatic Updates Options

The default settings of the plugin reflect the current WordPress default settings for automatic updates. In effect, enabling the automatic updates features of the plugin does nothing new except ensure that the plugin itself is kept up-t0-date.

Referring to the numbered options on the screenshot provided below, I’ll outline what they mean and what are the ideal settings:

Option 0: Turning on or off the whole Automatic Updates management feature

This option refers to the automatic updates management feature on the plugin – it does not refer to the WordPress Automatic Updates system (that’s the next option). If you want to use any of the other options on this page (to manage the WordPress automatic updates) then you need to turn on this option.

Option 1: Enable/Disables WordPress Automatic Updates

If you select this option it will completely turn off the whole WordPress Automatic Updates system. It doesn’t matter where else you might try to tweak settings, or if you use option within this plugin, you will completely disable the whole automatic updates system.

Option 2: Choose which WordPress core automatic updates are applied

By default, WordPress only applies updates for minor versions. With this option you can choose to never update the WordPress core automatically, or to apply major release updates as well as minor.

Options 3&4: Choose whether plugin and theme updates are automatically applied

When these options are selected, WordPress will automatically update any plugins or themes that it can. You need to use this option with care, as most plugin or theme updates should really be verified before being applied.

There are also other auto-update options available as shown on the screenshot provided below.

Option 5: Automatic Updates Delay Period

Shield Security will delay upgrades until the new update has been available for the set number of days. This helps ensure updates are more stable before they’re automatically applied to your site.

Option 6: Enable/Disable Automatic Plugin Self-Update

This refers to automatically updating the Shield plugin when a new update is released. This is highly recommended as it ensures Shield is running at the latest available secure version.

Option 7: Emails after automatic updates are applied

You can now specify who will, if you enable the option, receive email notifications when automatic updates are applied.

Who needs to manage Automatic Updates?

I think everyone should have a say in the updates that are applied to their sites. Not offering an options-interface to this critical feature on the part of the WordPress core development team is another step in the wrong direction. We are again forced under their will and their vision.

With iControlWP, you can also manage WordPress automatic updates, and even down to the granular level of selecting which plugins/themes are automatically updated. This implementation hasn’t made it into Shield due to its complexity. If that level of control is something you’re interested in, please sign-up for the free trial here and give it a go.